PortSwigger researcher James Kettle used an AI-assisted methodology to discover roughly 30,000 novel HTTP desynchronization vectors, identifying approximately 700 vulnerable targets that include banks, government organizations, security products, and an airport. The research also surfaced a zero-day in Apache Traffic Server as part of the broader request-smuggling findings.
How HTTP Terminator Found 30,000 HTTP Desync Vectors
Kettle’s approach applies an AI-assisted method to systematically find HTTP request desynchronization techniques, expanding beyond the manual discovery that produced earlier request-smuggling findings. The vulnerability class is described as “Shared-Parser Confusion,” covering request parser quirks and dangling-byte parsing, where an intermediary and a backend parse the same request differently.
The Zero-Day and the Roughly 700 Vulnerable Targets
The research identifies around 700 vulnerable targets spanning banks, government organizations, security products, and an airport. A zero-day in Apache Traffic Server was found as part of the work. Desync attacks let an attacker poison or front-run requests in intermediaries such as reverse proxies, content delivery networks, and load balancers, enabling account takeover, cache poisoning, and request hijacking.
Why HTTP Desync Enables Account Takeover and Cache Poisoning
HTTP request smuggling takes advantage of the fact that an intermediary and a backend may disagree on where a request ends. With a desync, an attacker submits a request interpreted differently by the two components, so a poisoned or injected request then reaches the backend under a trusted context, enabling hijacked sessions, poisoned caches, or redirected requests.
The Scale of the Window Across Core Infrastructure
Because the attack affects the intermediaries at the perimeter of nearly every web service — proxies, load balancers, and CDN front-ends — the roughly 700 targets represent only the reachable subset of a far wider risk. Many organizations are likely running parser combinations that are affected even if they were not identified in the scan, and the variety of sectors from banks to an airport is a direct consequence of intermediaries being everywhere in web infrastructure.
What the HTTP Terminator Findings Mean for Defenders
For organizations, the practical point is to treat the parser stack — the combination of reverse proxy, load balancer, CDN, and backend — as part of the attack surface rather than as an invisible layer between users and their applications.
Validating End-of-Request Handling and Patching the ATS Zero-Day
Vendors with affected parsers, including Apache Traffic Server, should patch. Defenders should review proxy and backend parser configurations, validate end-of-request handling where Content-Length and Transfer-Encoding semantics meet, and monitor for smuggling indicators. The Apache Traffic Server zero-day should be patched when the fix is available, and organizations should test their own front-end and backend combinations against the published classes of vectors.
The HTTP Terminator results suggest the attack surface defined by HTTP parsing disagreements is wider than the industry has treated, and a single AI-guided scan produced 30,000 vectors and a live zero-day in a widely deployed caching proxy. Because these flaws are architectural, no single vendor closing one parser removes the desync risk across every exposed sector. Defenders who ask where two parsers disagree, and harden that boundary, will turn the findings into a concrete improvement instead of waiting on a patch that may not fully close the class.
The scale of the finding also reframes the role of the security researcher. Manually hunting request-smuggling edge cases yielded some of the most consequential web vulnerabilities of the past decade; the ability to have an AI system enumerate tens of thousands of parser interactions in a single research program changes the economics of discovery. That same capability, once in the hands of defenders and attackers alike, means parser disagreement is no longer a niche technique that a handful of specialists can survey. For application teams, the practical consequence is that intermediaries will keep being tested aggressively, and the combination of an AI-generated vector set with a live zero-day should be treated as an early signal that every HTTP edge, not just the explicitly audited ones, is now part of the research frontier.
